Back to Database
Status published
Critical
CVE-2018-10628
AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch...
Vulnerability Description
AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a specially crafted packet that could overflow the buffer on a locale not using a dot floating point separator. Exploitation could allow remote code execution under the privileges of the InTouch View process.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-10628
Credits & Attribution
No credits recorded in the NVD database.
Affected Vendor
AVEVA Software, LLC.
View all reports →Affected Software
InTouch
Vulnerable Versions:
2014 R2 SP1 and prior, 2017, 2017 Update 1, 2017 Update 2
Timeline
Official Publish:
July 24th, 2018
Last Modified:
September 16th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H